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(57) ABSTRACT 


In one aspect, a digital engine control system for an aircraft 
engine is provided. The control system includes a selection 
unit, the selection unit including a monitoring module con- 
figured to determine a measurement ofthe speed of rotation of 
the engine from the output signal from one or more protection 
sensors and to compare the or each speed measurement deter- 
mined by the selection unit with speed measurements sup- 
plied by electronic control units to determine an operating 
state of each electronic control unit. 
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FULL AUTHORITY DIGITAL ENGINE 
CONTROL SYSTEM FOR AIRCRAFT 


ENGINE 
BACKGROUND 
[0001] 1. Field of the Invention 
[0002] The present invention relates to a full authority digi- 


tal engine control system for an aircraft engine. 

[0003] 2. Description of the Related Technology 

[0004] Engine control systems are commonly referred to 
using the acronym FADEC, and are intended to control the 
engine by controlling the intake, for example, of fuel in an 
engine such as a helicopter turbine, or any other type of 
engine such as a reactor, a turbojet engine, etc., intended for 
other types of aircrafts, for example such as an airplane, an 
airship, etc. 

[0005] In fact and generally speaking, these systems fall 
within the field of electronic engine control units (EECUs), 
and in particular helicopter turbines. 

[0006] Traditionally, these control systems are connected 
on the one hand to a mechanism for controlling various oper- 
ating parameters of the engine, such as fuel intake or air 
intake, and on the other hand a mechanism forming speed 
sensors arranged on the engine. 

[0007] As a general rule, they comprise at least two redun- 
dant electronic control units connected to said mechanism 
forming speed sensors of the engine and a device for switch- 
ing between said units as a function of their operating status. 
[0008] Builders and rules require that the suppliers of this 
type of equipment respect a certain number of requirements 
in terms of operating safety. 

[0009] These requirements for example include parameters 
such as the MTBF (Mean Time Between Failure), break- 
down/flight time level, etc. 

[0010] For some of the aforementioned FADECS, one of 
the basic requirements is to have at least two redundant elec- 
tronic control units to control the fuel intake in the engine, 
which then makes it possible to continue controlling that 
engine in the event one of the units fails. 

[0011] Thus, ifthe electronic control unit currently operat- 
ing breaks down, the switching devicethen triggers the switch 
from the control of that faulty electronic control unit to the 
redundant electronic control unit. 

[0012] However, such devices are not fully satisfactory. In 
fact, the switching between electronic control units only 
occurs if the faulty electronic control unit declares itself 
faulty to the switching device or if the aircraft' s pilot detects 
that failure and orders the switch himself. 

[0013] Thus, FADECS with a double electronic control unit 
may fail ifthe currently operating electronic control unit fails 
without detecting it and/or without indicating it to the switch- 
ing device of the FADEC. 

[0014] In that case, the engine control is not transferred to 
the redundant electronic control unit and the pilot can only 
perform that switching manually if he identifies the source of 
the problem quickly enough. 

[0015] Ifthis is notthe case, the engine may run away, or on 
the contrary there may be a risk of a loss of power or burnout 
of the engine. 

[0016] Most FADECs of this type also frequently have an 
electronic overspeed protection system (EOSPS) for the 
emergency cut-off of the turbine to prevent deterioration 
thereof. 
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[0017] Inthe first scenario considered above, the electronic 
protection system then causes a cutoff of the turbine without 
any possibility of restarting the latter part. One can see that 
this situation may have serious repercussions. 

[0018] One aim of the invention is therefore to obtain a full 
authority digital engine control system for an aircraft engine 
having improved operating safety and availability. 


SUMMARY OF CERTAIN ASPECTS OF THE 
INVENTION 


[0019] Aspects of the invention relates to a digital engine 
control system for an aircraft engine including two redundant 
electronic control units to control the engine of the aircraft, 
each electronic control unit being adapted to determine a 
speed measurement of the engine from an output signal from 
a respective speed sensor representative of the speed of the 
engine. The system further includes a selection unit to select 
one or the other of the electronic control units to control the 
engine as a function of an operating state of the electronic 
control units. The system further includes an electronic over- 
speed protection system to protect the engine of the aircraft 
from overspeeds, from the output signal from at least one 
respective protection speed sensor representative of the speed 
of the engine. The selection unit includes a monitoring mod- 
ule adapted to determine a speed measurement of the engine 
from the output signal from the or each protection speed 
sensor and compare the or each speed measurement deter- 
mined by the monitoring module with the speed measure- 
ments supplied by each electronic control unit to determine 
an operating state of each electronic control unit. 

[0020] According to another aspect of the invention, the 
digital engine control system for an aircraft engine comprises 
one or more of the following features, considered alone or 
according to all technically possible combinations. The sur- 
veillance module may include a respective measurement 
module associated with each electronic control unit and 
adapted to determine a speed measurement of the engine from 
the output signal from at least one protection speed sensor, the 
monitoring module being adapted to compare the speed mea- 
surements supplied by each electronic control unit with the or 
each speed measurement determined by the associated mea- 
suring module. The monitoring module may be adapted to 
inhibit the selection of an electronic control unit if the elec- 
tronic control unit does not provide the monitoring module 
with a speed measurement. The monitoring module may be 
adapted to inhibit the selection of an electronic control unit if 
the speed measurement supplied by the electronic control unit 
over a measurement time period P is not received by the 
selection unit after a predetermined length of time e after the 
beginning of a new measurement time period P, e for example 
equal to 1 ms. 

[0021] The monitoring module may be adapted to inhibit 
the selection of an electronic control unit if the speed mea- 
surement supplied by the electronic control unit is not con- 
sistent with two speed measurements determined by the 
selection unit from output signals from the protection speed 
sensors, whereas the speed measurements determined by the 
selection unit are consistent with one another. A speed mea- 
surement V1 may be consistent with another speed measure- 
ment V2 if (1-8)*V2z V1x(149)*V2, à being equal to 0.1 
for example. 

[0022] The monitoring module may be adapted to compare 
the output signals from the control speed sensors and the 
output signals from the or each protection speed sensor so as 
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to verify the operation ofthe control speed sensors and/or the 
or each protection speed sensor. 

[0023] The monitoring module may be active to inhibit the 
selection of each electronic control unit only when a pre- 
defined number M of speed measurements determined by the 
monitoring module are representative of a speed of rotation of 
the engine above a predetermined threshold, for example a 
fraction of a nominal speed of rotation of the engine, in 
particular 4096. 

[0024] Theselection unit may include a test mode to test the 
monitoring module, in which the electronic control units send 
the monitoring module test signals in place of speed measure- 
ments. The test may be implemented only when the speed 
measurements determined by the monitoring module and the 
speed measurements determined by the electronic control 
units are representative of a speed of rotation below a thresh- 
old speed of rotation, for example a fraction of a nominal 
speed of rotation of the engine, in particular 2596. The selec- 
tion unit may be configurable. 

[0025] The overspeed protection system may include two 
redundant control paths to control the overspeed protection 
system, each control path comprising at least one measure- 
ment module for measuring the speed of the engine from the 
outputs ofthe protection speed sensors, the monitoring mod- 
ule providing information on the operating state of the over- 
speed protection system from the outputs of the measuring 
modules. 

[0026] The aircraft may be a helicopter. The engine may 
include a gas turbine stage and/or a free turbine stage. The 
engine may include two turbine stages, each electronic con- 
trol unit being adapted to determine a speed of rotation mea- 
surement of each turbine stage from an output signal from at 
least one respective control speed sensor representative ofthe 
speed of rotation of each turbine stage of the engine, respec- 
tively, the electronic overspeed protection system protecting 
the engine of the aircraft using the output signal from at least 
one respective protection speed sensor representative of the 
speed of rotation of each turbine stage of the engine, respec- 
tively, the monitoring module being adapted to determine a 
speed of rotation measurement of each turbine stage of the 
engine using the output signal from the or each protection 
speed sensor and compare the or each speed measurement 
determined by the monitoring module with the speed mea- 
surements provided by each electronic control unit to deter- 
mine an operating state of each electronic control unit. 


BRIEF DESCRIPTION OF THE DRAWINGS 


[0027] The invention will be better understood using the 
following description, provided solely as an example and 
done in reference to the appended figures, in which: 

[0028] FIG. 1 shows a summary diagram illustrating the 
structure and operation of a full authority digital engine con- 
trol system for an aircraft engine according to the invention, 
and 

[0029] FIG. 2 shows a summary diagram illustrating the 
structure and operation of the full authority digital engine 
control system for an aircraft engine according to one alter- 
native of the invention. 


DETAILED DESCRIPTION OF CERTAIN 
INVENTIVE EMBODIMENTS 


[0030] Inthe present description, the term “engine” must be 
understood in its general sense to designate the turbine, tur- 
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bine stage, reactor, turbojet engine, or other mechanism, for 
example, designed to equip an aircraft, this term also gener- 
ally for example designating a helicopter, an airplane, an 
airship, or other devices. 

[0031] Furthermore, the expression “speed of rotation of 
the engine" refers indifferently to the frequency of rotation or 
revolving period thereof. 

[0032] The full authority digital engine control system 10 
for an aircraft engine 12 shown in FIG. 1, hereafter “control 
system,” is connected in input to speed sensors 14, 16, 18, 20 
arranged on the engine 12 and in output to mechanism 24 for 
controlling the parameters of the engine 12. 

[0033] Each speed sensor 14, 16, 18, 20 provides an output 
signal representative of the speed of rotation of the engine 12. 
[0034] Inthe example of FIG. 1, the sensors 14, 16, 18, 20 
used are electromagnetic frequency sensors each associated 
with a phonic wheel that send the members of the control 
system 10 a frequency signal representative of the speed of 
rotation of a free turbine stage or a gas turbine stage com- 
prised by the engine 12. 

[0035] The parameters controlled by the control mecha- 
nism 24 are for example the fuel intake 26 in the engine 12, the 
air intake 28, the actuation of discrete accessories 30 associ- 
ated with the operation of the engine 12, etc. 

[0036] The control system 10 comprises two redundant 
electronic control units 32, 34, an electronic overspeed pro- 
tection system 36, hereafter EOSPS 36, as well as a selection 
unit 38 for selecting one or the other of the electronic control 
units 32, 34 to control the engine 12. 

[0037] Each of the electronic control units 32, 34, the 
EOSPS 36, and the selection unit 38 is autonomous with 
respect to the others, having its own power supply and com- 
putation unit. 

[0038] Each electronic control unit 32, 34 can control the 
engine 12 alone. 

[0039] Each electronic control unit 32, 34 comprises a mea- 
suring module 40, 42 to measure the speed of rotation of the 
engine 12 and an auto-monitoring module 44, 46. 

[0040] Optionally, the auto-monitoring module 44, 46 of 
each electronic control unit 32, 34 is a completely separate 
module to which the electronic control unit 44, 46 is con- 
nected. 

[0041] Each electronic control unit 32, 34 is connected to 
the selection unit 38, the other electronic control unit 32, 34, 
the control mechanism 24 of the engine parameters, and an 
external module 47. 

[0042] The external module 47 can emit an external selec- 
tion signal to the selection unit 38 and the electronic control 
units 32, 34. The signal predetermines the electronic control 
unit 32, 34 in charge of controlling the engine 12 when both 
electronic control units 32, 34 are capable of controlling the 
engine or the selection unit 38 fails, as will be seen hereafter. 
[0043] The measuring module 40, 42 of each electronic 
control unit 32, 34 is connected to the output of a respective 
speed sensor 14, 16, hereafter “control speed sensor 14, 16.” 
[0044] The measuring module 40, 42 of each electronic 
control unit 32, 34 can determine a speed measurement from 
theoutput signal ofthe associated control speed sensor 14, 16. 
[0045] As illustrated in FIG. 1, the measuring module 40 of 
the first electronic control unit 32 is connected to the output of 
the first control speed sensor 14 and the measuring module 42 
of the second electronic control unit 34 is connected to the 
second control speed sensor 16. 
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[0046] The output signal of the control speed sensor 14, 16 
is converted by the associated measuring module 40, 42 into 
a measurement NTL x ofthe speed of rotation ofthe engine 12 
equal to NTLx-NTL/Nx, NTL being the actual speed of 
rotation of the engine 12, and Nx a scaling factor depending 
on the number of teeth of the corresponding control speed 
sensor 14, 16. 

[0047] In practice, NTL is proportional to the speed of 
rotation of a stage of the engine 12, as described above. NTL 
therefore depends on the scaling between the speeds of rota- 
tion of the stages of the engine 12 and the speed of rotation of 
the shaft of the engine 12 on which the sensor is mounted. The 
parameter Nx is specific to a phonic wheel comprised by the 
sensor. 

[0048] From the speed measurement, the operating elec- 
tronic control unit 32, 34 controls the operation of the engine 
12. 

[0049] Inthe control system 10 according to the invention, 
the measuring modules 40, 42 for measuring the speed of 
each electronic control unit 32, 34 are also adapted to peri- 
odically measure, with a frequency P, the speeds T(NTLR1) 
and T(NTLR2) respectively defined by: 


T(NTLR1)=NmesR1*NTLR1/NDR1 and 


T(NTLR2)-NmesR2*NTLR2/NDR2, 


[0050] NmesR1 and NmesR2 being the numbers of inter- 
tooth spaces ofthe control speed sensors 14, 16 on which the 
measurements are done, and NDR1 and NDR2 being the 
ratios between the revolving period of the engine 12 and the 
inter-tooth period of the corresponding speed sensor 14, 16. 
[0051] These measurements are done with a sampling 
clock with a high enough frequency to obtain sufficiently 
precise measurements, for example 10 Mhz, and with a period 
P for example equal to 20 ms. 

[0052] The auto-monitoring module 44, 46 of each elec- 
tronic control unit 32, 34 serves to deliver status information 
of the electronic control unit 32, 34 to the selection unit 38. 

[0053] The auto-monitoring module 44, 46 is adapted to 
deliver independent signals to the selection unit 38 to indicate 
various causes of malfunctions, for example hardware or 
software, or to indicate various degrees of unavailability, for 
example deteriorated control capacity or total inability to 
control. 

[0054] The electronic overspeed protection system 36 
(EOSPS 36) can verify that the speed of rotation of the engine 
12 remains below a given maximum speed. 

[0055] The maximum speed of rotation is supplied by the 
builder and is an operating limit beyond which the engine 12 
may be damaged, possibly permanently. 

[0056] The EOSPS 36 comprises two redundant control 
paths 48, 50 that are connected in output to amember 51 of the 
solenoid valve type situated downstream of the control 
mechanism 24. This member 51 can cut off the fuel intake 26 
into the engine 12. 

[0057] Each control path 48, 50 comprises a measuring 
module 52, 54 for measuring the speed connected to the 
output of the speed sensors 18, 20, hereafter “protection 
speed sensors 18, 20.” 

[0058] As illustrated in FIG. 1, each control path 48, 50 is 
connected to the two protection speed sensors 18, 20, separate 
from the control speed sensors 14, 16. 

[0059] Ifthe speed ofrotation of the engine 12 measured by 
the control paths 48, 50 of the EOSPS 36 exceeds the maxi- 
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mum speed, the EOSPS 36 then orders the member 51 to 
extinguish the engine 12, which then cuts off the fuel intake 
26. 

[0060] The selection unit 38 can select either of the elec- 
tronic control units 32, 34 as a function of the status signal 
supplied by the auto-monitoring modules 44, 46 of the elec- 
tronic control units 32, 34, the external selection signal sup- 
plied for the external module 47, and the output of a moni- 
toring module 56 it comprises, as will be seen hereafter. 
[0061] The selection unit 38 can also monitor the electronic 
control units 32, 34. 

[0062] To that end, it comprises a monitoring module 56 for 
monitoring the electronic control units 32, 34. 

[0063] The monitoring module 56 can verify the consis- 
tency of the output signals emitted by each of the speed 
sensors 14, 16, 18, 20 and monitor the operation of the elec- 
tronic control units 32, 34. 

[0064] To that end, the monitoring module 56 is connected 
in input to the outputs of the control speed sensors 14, 16 and 
protection speed sensors 18, 20 and the outputs of the mea- 
suring modules 40, 42 of each electronic control unit 32, 34. 
The monitoring module 56 also comprises two measuring 
modules 58, 60 to measure the speed of rotation of the engine 
12 that are connected to the output of the protection speed 
sensors 18, 20, each measuring module 58, 60 being dedi- 
cated to one of the two electronic control units 32, 34. 
[0065] On the one hand, the monitoring module 56 verifies 
that the outputs of the protection speed sensors 18, 20 are 
consistent with the outputs of the control speed sensors 14, 
16, and consequently that the protection speed sensors 18, 20 
used by the EOSPS 36 are working. 

[0066] On the other hand, the monitoring module 56 moni- 
tors the operation of the electronic control units 32, 34 by 
cyclically diagnosing each of the electronic control units 32, 
34. 

[0067] To that end, each measuring module 58, 60 of the 
monitoring module 56 performs speed measurements NTLS1 
and NTLS2 of the speed of rotation of the engine 12 from 
outputs of the protection speed sensors 18, 20. 

[0068] | Foreach period with length P, these measuring mod- 
ules 58, 60 also perform measurements of the speeds 
T(NTLS1) and T(NTLS2) respectively defined by: 


T(NTLS1)-NmesSl *NTLS1/NDS1, and 


T(NTLS2)=NmesS2 *NTLS2/NDS2, 


[0069] NmesS1 and NmesS2 being the numbers of inter- 
tooth spaces of the protection speed sensors 18, 20 on which 
the measurements are done, and NDS1 and NDS2 being the 
ratios between the revolving period of the engine 12 and the 
inter-tooth period of the corresponding protection speed sen- 
sor 18, 20. 

[0070] The monitoring module 56 then compares the 
speeds T(NTLR1) and T(NTLR2) taken over a period P by 
the measuring modules 40, 42 of the electronic control unit 
32, 34 with the periods T(NTLS1) and T(NTLS2) done by the 
measuring modules 58, 60 of the monitoring module 56. 
[0071] The operation of the monitoring module 56 will now 
be described in relation to the first electronic control unit 32. 
[0072] During a period P, the measuring module 40 of the 
first electronic control unit 32 measures the speed NTLR1 
and the corresponding speed T(NTLR1) from the output of 
the control speed sensor 14 to which it is connected. 

[0073] Over the course of that same period, the measuring 
module 58 associated with the electronic control unit 32 
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performs the speed NTLS1 and NTLS2 and corresponding 
T(NTLS1) and T(NTLS2) measurements from the output of 
the protection speed sensors 18, 20 to which it is connected. 
[0074] At the end of this period P, the measurement 
T(NTLR1) is communicated by the computation unit of the 
electronic control unit 32 to the monitoring module 56. 
[0075] The beginning of the writing by the electronic con- 
trol module 32 in the monitoring module 56 triggers a new 
measurement of T(NTLR1) by the electronic control unit 32. 
[0076] Once the previous measurement T(NTLR1) has 
been completely communicated to the monitoring module 56, 
the latter uses the speed T(NTLR1) and the speeds T(NTLS1) 
and T(NTLS2) measured during the previous period to make 
the following comparisons: 


0.9*TQNTLST) -TONTLR1) -T(NTLS1 1.1, 
0.9*TQNTLS2) -TUNTLR1)-T(NTLS2)*1.1, and 


0.9*T(NTILS1)<I(NTLS2)<T(NILS1)* 1.1. 


[0077] These comparisons are so-called “consistency” 
comparisons, a speed measurement V1 being consistent with 
a speed measurement V2 if (1-8)*V2SV1S(1+8)* V2 . In 
the embodiment of FIG. 1, à is equal to 0.1. 
[0078] If the first inequality is true, the measurement 
NTLRI is then consistent with the measurement NTLSI. 
[0079] If the second inequality is true, the measurement 
NTLRI is then consistent with the measurement NTLS2. 
[0080] If the third inequality is true, the measurement 
NTLS2 is then consistent with the measurement NTLS1. 
[0081] The monitoring module 56 is adapted to declare the 
electronic control unit 32 faulty to the selection unit 38 if 
[0082] the electronic control unit 32 does not provide a 
measurement NTLRI1 during the period P, or 
[0083] ^ NTLRI is not consistent with NTLS1 or NTLS2 
whereas NTLS2 is consistent with NTLS1 and the asso- 
ciated control speed sensor 14 is operational, or 
[0084] the electronic control unit 32 has not communi- 
cated the measurement T(NTLR1) done during the pre- 
vious period at the end of a time e after the beginning of 
a new measuring period. 
[0085] In the example of FIG. 1, € is equal to 1 ms. 
[0086] Likewise, the monitoring module 56 is adapted then 
to declare the second electronic control unit 34 faulty to the 
selection unit 38 if: 
[0087] the electronic control unit 34 does not provide a 
measurement NTLR2 during the period P, or 
[0088] NTLR2 is not consistent with NTLS1 or NTLS2 
whereas NTLS2 is consistent with NTLS1 and the con- 
trol speed sensor 16 is operational, or 
[0089] the electronic control unit 34 has not communi- 
cated the measurement T(NTLR2) done during the pre- 
vious period at the end of the time e after the beginning 
ofa new measuring period. 
[0090] By declaring an electronic control unit 32, 34 faulty, 
the monitoring module 56 prohibits the selection of the elec- 
tronic control unit 32, 34 and therefore inhibits its selection 
by the selection unit 38. 
[0091] When the monitoring module 56 does not inhibit the 
selection of an electronic control unit 32, 34 and none of the 
electronic control units 32, 34 have declared themselves to be 
faulty, the selection unit 38 selects the predetermined elec- 
tronic control unit 32, 34 by the external selection signal it 
receives from the external module 47. 
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[0092] When the monitoring module 56 declares electronic 
control unit 32, 34 currently in use to be faulty to the selection 
unit 38, the latter orders the switch from the operating elec- 
tronic control unit 32, 34 to the redundant electronic control 
unit 32, 34 if the latter is available. 

[0093] In the event both electronic control units 32, 34 are 
faulty, the operating electronic control unit 32, 34 is deter- 
mined by default by the external selection signal emitted by 
the external module 47. 

[0094] The monitoring module 56 in a control system 10 
according to the invention thus allows a cyclic diagnosis of 
the electronic control unit 32, 34. 

[0095] This diagnosis is done completely independently of 
the auto-monitoring modules 44, 46 of each of the electronic 
control units 32, 34. 

[0096] During a silent failure of the electronic control unit 
32, 34 currently in control of the control mechanism 24, the 
monitoring module 56 still detects that failure and the selec- 
tion unit 38 then orders the switch of the selection to the 
redundant electronic control unit 32, 34: the control system 
10 according to the invention is thus no longer faulty when an 
electronic control unit 32, 34 is faulty without declaring it to 
the selection unit 38. 

[0097] One can then see that the robustness and availability 
of the control system 10 according to the invention are con- 
siderably increased. 

[0098] By performing cyclic monitoring of the electronic 
control units 32, 34, the monitoring module 56 simulta- 
neously diagnoses the capacity of the various computation 
units ofthe control system 10 to perform measurement acqui- 
sitions, conduct elaborate competitions, and perform a com- 
plex sequence of tasks. 

[0099] So as not to disrupt the operation of the selection 
unit 38, the monitoring module 56 can diagnose the electronic 
control unit 32, 34 only when a predefined number M of 
consecutive measurements of the speeds NTLS1 and NTLS2 
are above a predefined percentage of the speed of rotation of 
the engine 12. This in particular makes it possible to prevent 
switching from one electronic control unit 32, 34 toward the 
redundant unit when the turbine is in the intermediate rating, 
for example when it is being ignited or extinguished. 

[0100] Inthe example of FIG. 1, this percentage is consid- 
ered to be equal to 40% of the nominal speed of the engine 12. 
[0101] So as to be adaptable to all types of turbines and all 
types of stresses to which an aircraft may be subjected, the 
monitoring module 56 also has a configuration mode. 
[0102] This mode is used to adjust the operation of the 
monitoring module 56 to various types of sensors, frequency 
sensors having different characteristics, different real-time 
stresses applied to the airplane, etc. 

[0103] This configuration mode for example makes it pos- 
sibleto adjust the speed threshold below which a test mode of 
the selection unit 38 may be activated, as will be seen here- 
after, or the number M of successive measurements of the 
speeds NTLS1 and NTLS2 needed to activate the monitoring 
of the electronic control units 32, 34. 

[0104] Optionally, the monitoring module 56 is also 
adapted to monitor the control paths 48, 50 ofthe EOSPS 36. 
[0105] To that end, the monitoring module 56 is connected 
to the outputs ofthe measuring modules 52, 54 of each ofthe 
control paths 48, 50 of the EOSPS. 

[0106] The consistency comparisons between the speed 
measurements done by the control paths 48, 50 during diag- 
nosis and the measurements done by the measuring modules 
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58, 60 ofthe monitoring module 56 are done in the same way 
asinthe caseofan electronic control unit 32, 34, a measuring 
module 58, 60 being dedicated to each control path 48, 50 of 
the EOSPS 36. 

[0107] As a function of the results of these consistency 
comparisons, if one of the control paths 48, 50 is diagnosed as 
being faulty by the monitoring module 56, the latter then 
provides the pilot or maintenance personnel with operating 
status information regarding the EOSPS 36, for example the 
one of the control paths 48, 50 is faulty, the EOSPS 36 is 
operating in degraded mode, maintenance is required, etc. 
[0108] Itshould be noted that aeronautic safety and security 
regulations require that the operation of the EOSPS 36 be 
independent from the control system 10. As a result, the 
monitoring module 56 diagnoses the EOSPS 36, but cannot 
modify its operation. 

[0109] The robustness ofthe selection unit 38 is ensured by 
robustness criteria that must be met by status changes on one 
or more inputs of the selection unit 38 for the switch toward 
the redundant control unit 32, 34 to take place. 

[0110] These criteria are the following: 

[0111] the selection change ofthe electronic control unit 
32, 34 must take place no later than after a predefined 
time period beginning upon the change of an input status 
of the selection unit 38, 

[0112] an input status change is only taken into account 
if the new status on that input is constant over a mini- 
mum length of time, and 

[0113] the conditions leading to this modification of the 
selection are maintained for a minimum length of time. 

[0114] In the example FIG. 1, the selection unit 38 is 
adapted so as to: 

[0115] modify the selection no later than 500 ms after a 
change of input status, 

[0116] only switch to a redundant electronic control unit 
32, 34 ifthe new input status is maintained for at least 10 
ms and if the conditions leading to the selection are 
maintained for at least 100 ms. 

[0117] Inpractice, the result ofthe selection is accessible in 
read mode by the electronic control units 32, 34 via a bus to 
whichthey are connected. The selection unit 38 then sends the 
results of the selection to the two electronic control units 32, 
34 using a bit sequence coding the selected electronic control 
unit 32, 34. 

[0118] In the example of FIG. 1, the sequence “10101” 
codes the selection of the first electronic control unit 32, and 
the sequence “11011” for example codes the selection of the 
second electronic control unit 34. 

[0119] Furthermore, the selection unit 38 can be diagnosed 
by the electronic control units 32, 34. 

[0120] To that end, each electronic control unit 32, 34 is 
connected to the inputs of the selection unit 38. 

[0121] Inthe example of FIG. 1, these inputs are accessible 
in read mode by the electronic control units 32, 34 via a serial 
bus to which they are connected. The transmission method 
used is of the differential type and is based on coding of the 8 
bit/10 bit type. This method allows the use of an isolation 
transformation between each of the electronic control units 
32, 34 and the selection unit 38 as well as coverage of trans- 
mission errors. 

[0122] Each electronic control unit 32, 34 therefore has 
access both to the input and output of the selection unit 38. 
They then communicate to compare the information received 
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from the selection unit 38 and verify the consistency between 
the statuses ofthe inputs ofthe selection unit 38 and the result 
ofthe selection. 

[0123] The selection unit 38 also comprises an exhaustive 
test mode during which the monitoring module 56 is also 
tested. 

[0124] This so-called “intrusive” test takes place during the 
start-up phase of the engine 12, for example when the speeds 
measured by the different members of the control system 10 
are all below a predefined value of the nominal speed of the 
engine 12, for example 25%. 

[0125] The electronic control units 32, 34 then emit, to the 
selection unit 38, sequences of coordinated signals corre- 
sponding to various expected selection results from the selec- 
tion unit 38. The outputs of the selection unit 38 are then 
compared by the two electronic control units 32, 34 to deter- 
mine the operating state of the selection unit 38. 

[0126] Furthermore, the frequency signals from the speed 
sensors 14, 16, 18, 20 are replaced by test signals generated by 
the selection unit 38 so as to test the behavior of the monitor- 
ing module 56. 

[0127] During this intrusive test, the electronic control 
modules 32, 34 are authorized to write in the selection unit 38 
to modify the operation thereof. 

[0128] In the event of a breakdown of the selection unit 38 
detected by the electronic control units 32, 34, the electronic 
control unit 32, 34 currently in control is determined by the 
external selection signal emitted by the external module 47. 
[0129] In practice, the selection unit 38 is segregated from 
the two electronic control units 32, 34. 

[0130] The selection unit 38 is thus mechanically and/or 
electrically isolated from the two electronic control units 32, 
34. It also has an independent or consolidated electricity 
source from the power supplies for each of the electronic units 
32, 34. 

[0131] The selection unit 38 has its own clock source inde- 
pendent from the clock sources used in the electronic units 
and does not use phase-lock loop (PLL) devices to avoid 
oscillations on frequencies specific to the phase loop. 
[0132] Optionally, in reference to FIG. 2, the control sys- 
tem 10 can simultaneously control both a free turbine stage 
12B and a gas turbine stage 12A comprised by the engine 12, 
the stages having speeds of rotation that are independent of 
one another. 

[0133] To that end, aside from the members of the control 
system 10 adapted to control a single turbine stage illustrated 
in FIG. 1, the control system 10 according to this alternative 
ofthe invention comprises the following features. 

[0134] The electronic control units 32, 34 respectively 
comprise measuring modules 40', 42' supplying measure- 
ments of the speed of rotation of the second stage 12A con- 
trolled from the outputs of control speed sensors 14', 16' 
arranged in contact with said second stage 12A. 

[0135] Furthermore, each path 48, 50 of the EOSPS 36 
respectively comprises a speed measuring module 52', 54' 
from the outputs of two protection speed sensors 18', 20' 
arranged on the second turbine stage 12A. The EOSPS 36 
then commands the cut-off of the fuel intake 26 by the mem- 
ber 51 when one of the speed measurements of one of the 
stages 12A, 12B of the motor 12 is above a set threshold 
value. 

[0136] Furthermore, the monitoring module 56 is con- 
nected to the outputs of the sensors 14', 16', 18', 20' and 
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comprises two speed measuring modules 50', 60' each con- 
nected to the outputs of two protection speed sensors 18', 20'. 
[0137] The monitoring module 56 then cyclically diag- 
noses the capacity of the electronic control units 32, 34 to 
regulate the two turbine stages 12A, 12B at the same time by 
performing the consistency comparisons for each of the tur- 
bine stages 12A, 12B from the outputs of the corresponding 
measuring modules 40, 40', 42, 42', 58, 58', 60, 60' and the 
outputs of the speed sensors of the two turbine stages 12A, 
12B. 

[0138] Furthermore, the monitoring module 56 can give the 
pilot or personnel operating status information ofthe EOSPS 
36 from the outputs of the speed measuring modules 52, 52', 
54, 54' of the control paths 48, 50 and the outputs of the 
protection speed sensors 18, 18', 20, 20'. 

[0139] Also optionally, the monitoring module 56 performs 
the diagnosis of the electronic control units 32, 34 from the 
outputs of any number of control and protection speed sensors 
arranged on the free 12B and gas 12A turbine stages of the 
engine 12, each turbine stage ofthe engine 12 having, ifthe or 
each corresponding control speed sensor is present, a dedi- 
cated: 

[0140] speed measuring module 52, 52', 54, 54' for mea- 
suring the speed by control path 48, 50 ofthe EOSPS 36, 

[0141] measuring module 40, 40', 42, 42' for measuring 
the speed by electronic control unit 32, 34, and 

[0142] atleast one speed measuring module 58, 50', 60, 
60' for the monitoring module 56. 

[0143] For example, the free 12B and gas 12A turbine 
stages of the engine 12 can be controlled simultaneously by 
the control system 10 according to the invention from a con- 
trol speed sensor supplying information representative of the 
speed of rotation of the free turbine stage 12B, and a control 
speed sensor and two protection speed sensors providing 
information representative of the speed of rotation of the gas 
turbine stage 12A of the engine 12. 

[0144] While there have been shown and described and 
pointed out the fundamental novel features ofthe invention as 
applied to certain inventive embodiments, it will be under- 
stood that the foregoing is considered as illustrative only of 
the principles ofthe invention and not intended to be exhaus- 
tive or to limit the invention to the precise forms disclosed. 
Obvious modifications or variations are possible in light of 
the above teachings. The embodiments discussed were cho- 
sen and described to provide the best illustration of the prin- 
ciples of the invention and its practical application to enable 
one of ordinary skill in the art to utilize the invention in 
various embodiments and with various modifications as are 
suited to the particular use contemplate. All such modifica- 
tions and variations are within the scope of the invention as 
determined by the appended claims when interpreted in 
accordance with the breadth to which they are entitled. 

What is claimed is: 

1. A digital engine control system for an aircraft engine 

comprising: 

two redundant electronic control units configured to con- 
trol the engine ofthe aircraft, each electronic control unit 
being configured to determine a speed measurement of 
the engine from an output signal from a respective speed 
sensor representative of the speed of the engine; 

a selection unit configured to select one or the other of the 
electronic control units to control the engine as a func- 
tion of an operating state of the electronic control units; 
and 
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an electronic overspeed protection system configured to 
protect the engine of the aircraft from overspeeds, from 
the output signal from at least one respective protection 
speed sensor representative of the speed of the engine, 
wherein the selection unit comprises a monitoring mod- 
ule configured to determine a speed measurement of the 
engine from the output signal from the or each protec- 
tion speed sensor and compare the or each speed mea- 
surement determined by the monitoring module with the 
speed measurements supplied by each electronic control 
unit to determine an operating state of each electronic 
control unit. 


2. The system of claim 1, wherein the surveillance module 
comprises a respective measurement module associated with 
each electronic control unit and configured to determine a 
speed measurement ofthe engine from the output signal from 
at least one protection speed sensor, the monitoring module 
being configured to compare the speed measurements sup- 
plied by each electronic control unit with the or each speed 
measurement determined by the associated measuring mod- 
ule. 

3. The system of claim 1, wherein the monitoring module 
is configured to inhibit the selection of an electronic control 
unit if the electronic control unit does not provide the moni- 
toring module with a speed measurement. 

4. The system of claim 1, wherein the monitoring module 
is configured to inhibit the selection of an electronic control 
unit if the speed measurement supplied by the electronic 
control unit over a measurement time period (P) is not 
received by the selection unit after a predetermined length of 
time e after the beginning of a new measurement time period 
(P). 

5. The system of claim 1, wherein the monitoring module 
is configured to inhibit the selection of an electronic control 
unit if the speed measurement supplied by the electronic 
control unit is not consistent with two speed measurements 
determined by the selection unit from output signals from the 
protection speed sensors, whereas the speed measurements 
determined by the selection unit are consistent with one 
another. 


6. The system ofclaim 5, wherein a speed measurement V1 
is consistent with another speed measurement V2 if (1-8) 
*V2=V135(1+5)*V2, à is equal to 0.1. 

7. The system of claim 1, wherein the monitoring module 
is configured to compare the output signals from the control 
speed sensors and the output signals from the or each protec- 
tion speed sensor so as to verify the operation of the control 
speed sensors and/or the or each protection speed sensor. 

8. The system of claim 1, wherein the monitoring module 
is configured to inhibit the selection ofeach electronic control 
unit only when a predefined number M of speed measure- 
ments determined by the monitoring module are representa- 
tive of a speed of rotation ofthe engine above a predetermined 
threshold based at least in part on a fraction of a nominal 
speed of rotation of the engine. 

9. The system of claim 1, wherein the selection unit com- 
prises a test mode to test the monitoring module, in which the 
electronic control units send the monitoring module test sig- 
nals in place of speed measurements. 

10. The system of claim 9, wherein the test is implemented 
only when the speed measurements determined by the moni- 
toring module and the speed measurements determined by the 
electronic control units are representative of a speed of rota- 
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tion below a threshold speed of rotation based at least in part 
on a fraction of a nominal speed of rotation of the engine. 


11. The system of claim 1, wherein the selection unit is 
configurable. 


12. The system of claim 1, wherein the overspeed protec- 
tion system comprises two redundant control paths config- 
ured to control the overspeed protection system, each control 
path comprising at least one measurement module configured 
to measure the speed of the engine from the outputs of the 
protection speed sensors, the monitoring module providing 
information on the operating state ofthe overspeed protection 
system from the outputs of the measuring modules. 


13. The system of claim 1, wherein the aircraft is a heli- 
copter. 


14. The system of claim 1, wherein the engine comprises a 
gas turbine stage and/or a free turbine stage. 
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15. The system of claim 1, wherein the engine comprises 
two turbine stages, each electronic control unit being config- 
ured to determine a speed of rotation measurement of each 
turbine stage from an output signal from at least one respec- 
tive control speed sensor representative of the speed of rota- 
tion of each turbine stage of the engine, respectively, the 
electronic overspeed protection system protecting the engine 
ofthe aircraft using the output signal from at least one respec- 
tive protection speed sensor representative of the speed of 
rotation of each turbine stage of the engine, respectively, the 
monitoring module being configured to determine a speed of 
rotation measurement of each turbine stage of the engine 
using the output signal from the or each protection speed 
sensor and compare the or each speed measurement deter- 
mined by the monitoring module with the speed measure- 
ments provided by each electronic control unit to determine 
an operating state of each electronic control unit. 


* * * * * 


